FCAC Administrative Monetary Penalties Framework

Introduction

This document sets out the framework used by the Financial Consumer Agency of Canada’s (FCAC) Supervision and Enforcement Branch to determine the proposed administrative monetary penalty (penalty) to be included in a Notice of Violation issued to a financial institution or a payment card network operator (collectively referred to as Regulated Entity or RE).

The Deputy Commissioner, Supervision and Enforcement Branch, may issue a Notice of Violation when there are reasonable grounds to believe that a RE has breached a legal obligation, also known as a consumer provision, or when a RE has breached a Compliance Agreement. The Notice of Violation identifies an alleged violation, the RE who is believed to have committed it, and proposes a penalty for same.

The RE may, within 30 days of being served with a Notice of Violation, make representations to the Commissioner. Where representations are made, the Commissioner decides whether the violation was committed as alleged and whether to impose the penalty proposed in the Notice of Violation, a lesser penalty or no penalty. This is in keeping with the Commissioner’s adjudicative responsibility as the sole decision maker in regard to the alleged violations and proposed penalties that come before him/her.

Subsection 19(2) of the Financial Consumer Agency of Canada Act (FCAC Act) sets the maximum penalty for a violation to be $10,000,000 in the case of a violation that is committed by an RE or $1,000,000 in the case of a violation that is committed by a natural person.^{Footnote 1}

Section 20 of the FCAC Act sets out the criteria to be taken into account when determining a penalty. These are:

• the harm done by the violation
• the degree of intention or negligence on the part of the RE
• the duration of the violation
• the history of violations within the five years previous to the violation
• the ability to pay the penalty

Determining the penalty amount

In accordance with the summary table below, each of the criteria will be assessed to arrive at a proposed penalty amount.

In the assessment of each of the criteria, several factors will be considered. These factors may include, but are not limited to, those identified below.

Harm and related duration

Factors considered may include:

• number of impacted consumers
• dollar value impact to consumers (for example, total, average, highest, lowest)
• opportunity costs for consumers
• RE’s actions in identifying impacted consumers and providing redress/remediation
• potential harm to the RE’s compliance culture
• potential harm to the reputation of, or consumer confidence in, the sector
• length of time the breach was in effect as it relates to harm

Negligence/Intent and related duration

Factors considered may include:

• controls in place to prevent a breach (for example, policies and procedures, testing, audits, training)
• controls in place to detect a breach
• implementation of controls
• whether FCAC communicated with the sector or the RE about the issue related to the breach and related actions taken by the RE
• lack of appropriate consideration by the RE to consequences of its actions
• length of time the breach was in effect as it relates to negligence/intent

Violation history

Factors considered may include:

• number of previous violations for the same provision
• number of violations for related provisions
• number of violations for any provision

Ability to pay

In considering the RE’s ability to pay a penalty, FCAC may rely on the RE's financial information such as annual revenue and net income.